FWIW my stance on privacy regulation is that it is severely needed, both for consumers AND for businesses, because data deregulation can only lead to unbreakable monopolies, while fully applied GDPR allows user to resell the private data Google got on them, to the next, newcomer, bidder.

That being said I don't really agree with the premise of your comment. A law that isn't applied shouldn't be considered a law, and saying "you should just have applied the law from the start" isn't always fair. For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. French privacy laws 1980s already had a real scope on privacy, but it was barely applied. Applying a 40 years old law out of nowhere would simply be targeted attacks to the current disgraced company.

Now, GDPR is really recent, so I won't put it in the "hasn't been used for so long it's dead" basket. Though I kinda think that the portability part of GDPR will (I'm crossing fingers it will still happen, because I think it's the best part)